The invention pertains to data disturb vulnerabilities in Dynamic Random Access Memory (DRAM) integrated circuits. In particular, it pertains to mitigating attacks on a computational system by deliberate inducement of disturbs on a targeted row (also known as “row hammering”) in the system's DRAM memory. The stream of row addresses accompanying ACTIVE commands is monitored and filtered to only track addresses that occur at a dangerous rate and reject addresses that occur at less than a dangerous rate. When a tracked address poses a danger of causing a memory disturb, each row adjacent to the tracked address row is refreshed thus mitigating the danger.
Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A method for mitigating data loss in a memory array with addressable rows, wherein each addressable row requires regular refresh operations, wherein each addressable row is physically adjacent to at least one other addressable row, and wherein the memory array is coupled (i) to a decoder further coupled to address inputs, and (ii) to command circuitry further coupled to command inputs, the method comprising: (A) monitoring the command inputs to detect row activate commands; (B) monitoring the address inputs to detect a sequence of active row addresses, each active row address associated with a row activate command; (C) identifying one or more detected row addresses by presenting the sequence of active row addresses to a first filter coupled to the address inputs, the first filter detecting when an active row address occurs at a more frequent rate than a predetermined maximum rate; and (D) presenting each detected row address to a second filter coupled to the first filter, wherein: (i) upon a first detection of a detected row address that row address is stored in a tracked address memory location, each tracked address memory location being coupled to a first associated counter and a second associated counter, each counter having a stored value, (ii) the first associated counter and the second associated counter are both reset when the detected row address is first stored in the tracked address memory location, (iii) upon a subsequent detection of the detected row address in the tracked memory address location the first associated counter is incremented, and (iv) upon detection of every detected row address the second associated counter is incremented, and (v) wherein: if the value in any first counter exceeds a first predetermined value, then a non-regular data loss mitigation refresh operation is performed for the one or more addressable rows physically adjacent to detected row address stored in the associated tracked memory address location.
A method to prevent data loss in DRAM memory due to row hammering. The method monitors DRAM command inputs for row activation commands and tracks the addresses of activated rows. A first filter identifies rows activated more frequently than a set threshold. A second filter tracks these "hammered" row addresses. When a row address is first detected as potentially dangerous, it's stored with two counters (first and second) which are reset. The first counter increments each time the same hammered row is subsequently activated. The second counter increments upon every detection of an activated row. If the first counter exceeds a limit, the rows physically adjacent to the hammered row are refreshed immediately, preventing data corruption.
2. The method of claim 1 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the previous description, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
3. The method of claim 1 , further comprising the step: (E) resetting the first associated counter and the second associated counter coupled to each tracked address memory location either: when a non-regular data loss mitigation refresh operation for each row physically adjacent to the detected row address stored in the tracked memory location is performed, or when a regular row refresh operation for each row physically adjacent to the detected row address stored in the tracked memory location is performed.
The data loss mitigation method from the first description also includes a counter reset mechanism. The first and second counters associated with a tracked row address are reset after either a data loss mitigation refresh is performed on adjacent rows (due to excessive hammering) OR after the adjacent rows are refreshed as part of the normal periodic DRAM refresh cycle. This prevents the counters from overflowing or accumulating stale counts.
4. The method of claim 3 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the counter reset mechanism, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
5. The method of claim 3 , wherein the first filter comprises a first memory: wherein the first memory further comprises a plurality of first data words, wherein each of the first data words is configured to have an associated match flag, wherein each first data word contains an active row address written in sequence in a first in/first out (FIFO) manner from the sequence of active row addresses presented to the first filter, wherein each match flag is reset when an active row address is written into the associated first data word, wherein the associated match flag is set for each of the first plurality of data words where the contents of the data word match the presented active row address, and wherein the associated match flag is not set for each of the first plurality of data words where the contents of the data word do not match the presented active row address.
In the data loss mitigation method from the first description, the first filter uses a FIFO memory to track recent row activations. This memory consists of multiple entries, each associated with a "match flag." As row addresses are activated, they are written into the FIFO memory. When a new address is written, the corresponding entry's match flag is reset. Then, the new address is compared against every address in the FIFO. Match flags are set for FIFO entries holding the same address as the new one, and remain reset for non-matching addresses. This allows easy identification of frequently accessed row addresses exceeding the refresh rate.
6. The method of claim 5 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the FIFO memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
7. The method of claim 5 , wherein the second filter comprises a second memory: wherein the second memory further comprises second data words, each second data word being a tracked address memory location, and wherein each second data word contains a detected row address written into the second memory in a random access manner.
In the data loss mitigation method from the first description, the second filter uses a memory to store the addresses of rows that are hammered excessively. This memory, the "tracked address memory," stores these addresses in a random access manner. Each entry in this memory represents a location where a potentially dangerous row address is stored for monitoring.
8. The method of claim 7 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the tracked address memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
9. The method of claim 7 , further comprising the steps: (F) selecting one of the plurality of second data words, the selected second data word being eligible to be selected if the stored value of its associated second counter is greater than a second predetermined value; (G) writing a detected row address into the selected second data word when the detected row address does not match the contents of any of the tracked address memory locations in the plurality of second data words is presented to the second filter; (H) resetting first counter associated with the selected one of the second data words; and (I) resetting second counter associated with the selected one of the second data words.
The data loss mitigation method including FIFO for initial filtering and random access memory for tracking potential row hammer attacks includes a mechanism for managing the tracked address memory. When a new hammered row is detected that is not already in tracked address memory, an entry is selected based on the stored value of its associated second counter. If an entry's counter exceeds a second predetermined value, the entry is eligible for replacement. The new hammered row address is written to the selected entry, and the first and second counters associated with that entry are reset.
10. The method of claim 3 , wherein the second filter comprises a second memory: wherein the second memory further comprises second data words, each second data word being a tracked address memory location, wherein each second data word contains a detected row address written into the second memory in a random access manner.
In the data loss mitigation method that includes a counter reset mechanism, the second filter uses a memory to store the addresses of rows that are hammered excessively. This memory, the "tracked address memory," stores these addresses in a random access manner. Each entry in this memory represents a location where a potentially dangerous row address is stored for monitoring.
11. The method of claim 10 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the counter reset mechanism and the tracked address memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
12. The method of claim 10 , further comprising the steps: (F) selecting one of the plurality of second data words, the selected second data word being eligible to be selected if the stored value of its associated second counter is greater than a second predetermined value; (G) writing a detected row address into the selected second data word when the detected row address does not match the contents of any of the tracked address memory locations in the plurality of second data words is presented to the second filter; (H) resetting first counter associated with the selected one of the second data words; and (I) resetting second counter associated with the selected one of the second data words.
The data loss mitigation method including counter reset and random access memory for tracking potential row hammer attacks includes a mechanism for managing the tracked address memory. When a new hammered row is detected that is not already in tracked address memory, an entry is selected based on the stored value of its associated second counter. If an entry's counter exceeds a second predetermined value, the entry is eligible for replacement. The new hammered row address is written to the selected entry, and the first and second counters associated with that entry are reset.
13. The method of claim 1 , wherein the first filter comprises a first memory: wherein the first memory further comprises a plurality of first data words, wherein each of the first data words is configured to have an associated match flag, wherein each first data word contains an active row address written in sequence in a first in/first out (FIFO) manner from the sequence of active row addresses presented to the first filter, and wherein each match flag is reset when an active row address is written into the associated first data word, wherein the associated match flag is set for each of the first plurality of data words where the contents of the data word match the presented active row address, and wherein the associated match flag is not set for each of the first plurality of data words where the contents of the data word do not match the presented active row address.
In the data loss mitigation method from the first description, the first filter uses a FIFO memory to track recent row activations. This memory consists of multiple entries, each associated with a "match flag." As row addresses are activated, they are written into the FIFO memory. When a new address is written, the corresponding entry's match flag is reset. Then, the new address is compared against every address in the FIFO. Match flags are set for FIFO entries holding the same address as the new one, and remain reset for non-matching addresses. This allows easy identification of frequently accessed row addresses exceeding the refresh rate.
14. The method of claim 13 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the FIFO memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
15. The method of claim 13 , wherein the second filter comprises a second memory: wherein the second memory further comprises second data words, each second data word being a tracked address memory location, wherein each second data word contains a detected row address written into the second memory in a random access manner.
In the data loss mitigation method that includes FIFO memory for filtering, the second filter uses a memory to store the addresses of rows that are hammered excessively. This memory, the "tracked address memory," stores these addresses in a random access manner. Each entry in this memory represents a location where a potentially dangerous row address is stored for monitoring.
16. The method of claim 15 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register, and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the FIFO memory and the tracked address memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
17. The method of claim 15 , further comprising the steps: (F) selecting one of the plurality of second data words, the selected second data word being eligible to be selected if the stored value of its associated second counter is greater than a second predetermined value; (G) writing a detected row address into the selected second data word when the detected row address does not match the contents of any of the tracked address memory locations in the plurality of second data words is presented to the second filter; (H) resetting first counter associated with the selected one of the second data words; and (I) resetting second counter associated with the selected one of the second data words.
The data loss mitigation method including FIFO initial filter, and random access memory for tracking potential row hammer attacks includes a mechanism for managing the tracked address memory. When a new hammered row is detected that is not already in tracked address memory, an entry is selected based on the stored value of its associated second counter. If an entry's counter exceeds a second predetermined value, the entry is eligible for replacement. The new hammered row address is written to the selected entry, and the first and second counters associated with that entry are reset.
18. The method of claim 1 , wherein the second filter comprises a second memory: wherein the second memory further comprises second data words, each second data word being a tracked address memory location, wherein each second data word contains a detected row address written into the second memory in a random access manner.
In the data loss mitigation method, the second filter uses a memory to store the addresses of rows that are hammered excessively. This memory, the "tracked address memory," stores these addresses in a random access manner. Each entry in this memory represents a location where a potentially dangerous row address is stored for monitoring.
19. The method of claim 18 , wherein the predetermined maximum rate is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register; and wherein the predetermined maximum number of occurrences is specified by data stored in one of the group consisting of: (i) a non-volatile memory and (ii) a mode register.
The data loss mitigation method, specified in the description that includes the tracked address memory, uses a configurable threshold for identifying frequently accessed rows. The maximum row activation rate allowed before triggering adjacent row refreshes, and the number of excessive row activations before triggering action, can be configured. These configuration values are stored in either non-volatile memory (e.g., flash) or in a mode register within the DRAM chip.
20. The method of claim 18 , further comprising the steps: (F) selecting one of the plurality of second data words, the selected second data word being eligible to be selected if the stored value of its associated second counter is greater than a second predetermined value; (G) writing a detected row address into the selected second data word when the detected row address does not match the contents of any of the tracked address memory locations in the plurality of second data words is presented to the second filter; (H) resetting first counter associated with the selected one of the second data words; and (I) resetting second counter associated with the selected one of the second data words.
The data loss mitigation method including random access memory for tracking potential row hammer attacks includes a mechanism for managing the tracked address memory. When a new hammered row is detected that is not already in tracked address memory, an entry is selected based on the stored value of its associated second counter. If an entry's counter exceeds a second predetermined value, the entry is eligible for replacement. The new hammered row address is written to the selected entry, and the first and second counters associated with that entry are reset.
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
February 9, 2016
November 7, 2017
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.